REMARKS 

Claims 1-30 remain pending in the instant application. Claims 1-30 presently 
stand rejected. Claims 7, 19, 26, and 30 have been amended. No new matter has been 
added. Reconsideration of the pending claims is respectfully requested. 

Drawings 

The Office Action mailed on October 15, 2007 indicated that the drawings are 
acceptable to the Examiner. 

Claim Rejections - 35 U.S.C. §112 
Claims 19, 26, and 30 stand rejected under 35U.S.C.§112 because the term 
"substantial" is alleged to be a relative term which renders the claim indefinite. The 
claims have been amended to remove the term. 

Claim Rejections - 35 U.S.C § 103 
Claims 1-18, 20-25, and 27-30 stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Lettvin (US 5,826,012) and further in view of Ho et ah, (US 
7,188,369). Claims 19, 26, and 30 stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Lettvin and Ho, as applied to claim 1 above, and further in view of 
Huntington et al, (US 6,907,524). 

Applicants respectfully traverse the Office Action's rejections. To 
establish a prima facie case of obviousness, three criteria must be met: (1) the prior art 
references must teach or suggest all the claim limitations; (2) some suggestion or 
motivation to combine the references must be found in the prior art; and (3) there must 
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be a reasonable expectation of success. MPEP § 2143. As explained below, Applicants 
respectfully submit that the Office Action has not established a prima facie case of 
obviousness. 

Example independent claim 1 of the instant patent application as presently amended 
expressly recites: 

initializing a virus scanner during a pre-boot phase of a computer system; 

scrubbing data read from an input/output (I/O) device of the 
computer system by the virus scanner using a virus signature database 
before the data is loaded; and 

enacting a platform policy if a virus is detected in the data. 

In rejecting claim 1, the Office Action concedes that Lettvin is not explicit in 
teaching that the virus scanner uses a virus signature database (p. 3 Office Action mailed 
10/15/07). To attempt to make up for this deficiency in Lettvin, the Office Action cites 
Ho and concludes that it would have been obvious to one of ordinary skill in the art at 
the time of the invention to combine Lettvin with Ho to arrive at the claimed invention. 
The Office Action claims on page 3 that the motivation for doing so would be "to allow 
[the] system to use a plurality of virus signatures that can be continuously updated 
and/or replaced." 

Applicants respectfully disagree. The combination of Lettvin and Ho does not 

disclose, teach or suggest a process including the limitations of claim 1. Lettvin is 

directed to software that is executed at startup of the computer that provides anti-virus 

maintenance, and/or repair functions, (see Abstract). At the very least, Lettvin and Ho 

in motivated combination fail to teach or suggest the limitation that includes "scrubbing 

data read from an input/output (I/O) device of the computer system by the virus scanner 
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using a virus signature database before the data is loaded." Lettvin teaches against a 
modification that would allow it to perform the recited process steps. 

"To establish a prima facie case of obviousness... there must be some suggestion 
or motivation... to modify the reference or to combine reference teachings. MPEP § 
2143. If the proposed modification or combination of the prior art would change the 
principle of operation of the prior art invention being modified, then the teachings of the 
references are not sufficient to render the claims prima facie obvious. In re Ratti, 270 
F.2d 810, 123 USPQ 349 (CCPA 1959), MPEP 2143.01. 

Combining Lettvin with Ho as the Office Action suggests would change the 
principle of operation of the system disclosed in Lettvin. Ho teaches an antivirus 
scanning module operable with an operating system (see Abstract, Figure 3), while 
Lettvin teaches a bootstrap-time operating system [executed before the operating system 
is booted] that causes the computer to execute one or more anti virus or other programs 
and that facilitates the development and use of programs that must be executed before 
an ultimate operating system is executed (column 4, lines 45-64). 

Lettvin explains that executing [anti-virus software] before the ultimate operating 
system [executes] provides advantages to antivirus software because the software can 
take advantage of conditions within the computer that only exist during bootstrap and 
do not exist after the computer begins executing the ultimate operating system ( column 
4, lines 64-column 5, line 2). Lettvin further explains that viruses can, for example, 
modify the [boot sector] disk interrupt vector to point to themselves, and which is 
difficult to detect (column 5, lines 2-26). 
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Thus Lettvin seeks to avoid using an operating system, which can be hijacked by 
a virus on the boot sector of the disk used to boot the operating system. As described 
above, Lettvin instead teaches antivirus software that must be executed before 
executing the operating system, which avoids executing an operating system that may be 
compromised by a virus. 

Ho is directed to (column 3, lines 31-46) teaches an anti-virus scanning module 
with an operating system that provides library functions for accessing computer virus 
signatures in a database. Accessing the computer virus signatures thus require using the 
library functions provided by the operating system. The alleged motivations to combine 
the references (for example, a plurality of virus signatures that can be continuously 
updated and/or replaced, to detect newly occurring viruses, to detect newly created 
viruses asap, to detect viruses during all phases of OS usage, and downloading the virus 
signatures from an external repository), as taught by the cited art, would require the use 
an operating system (which can be compromised by a boot sector virus, for example) to 
make the virus signatures available to the antivirus software. Thus, to combine Lettvin 
with Ho would significantly change the principle of operation of Lettvin by requiring the 
use of an operating system which Lettvin seeks to avoid. 

Applicants further note that the "mere statement that the claimed invention is 
within the capabilities of one of ordinary skill in the art is not sufficient by itself to 
establish prima facie obviousness." MPEP § 2143.01. Furthermore, the mere "fact that 
references can be combined or modified ma\ be not sufficient to establish prima facie 
obviousness." Id. The tendency to resort to "hindsight" based upon Applicant's 
disclosure is often difficult to avoid due to the very nature of the examination process. 
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However, impermissible hindsight must be avoided and the legal conclusion must be 
reached on the basis of the facts gleaned from the prior art." MPEP § 2 142. 

Consequently, the combination of Lettvin and Ho fail to teach or suggest all 
elements of claim 1, as required under M.P.E.P. § 2143.03. Independent claims 12, 23, 
and 27 include similar nonobvious elements as discussed above in connection with 
independent claim 1. Accordingly, Applicants request that the instant § 103(a) rejections 
of claims 1, 12, 20 and 27 be withdrawn. 

With further regard to claim 27, the office action asserts that Ho teaches a virtual 
machine monitor (VMM) to support at least one virtual machine (VM). According to 
the instant specification: 

A VM behaves like a complete physical machine that can run its own OS. 
Usually, each VM session is given the illusion by the VMM that it is the only 
physical machine. The VMM takes control whenever a VM attempts to perform 
an operation that may affect the whole computer system 1 00. Each VM supports 
a corresponding OS and firmware. Multiple VM sessions are separate entities 
and usually isolated from each other by the VMM. If one OS crashes or 
otherwise becomes unstable, the other OS's should not be adversely affected. 

In contrast, Ho instead teaches a virtual scanning processor that is provided at the 
application program (AP) 302 (column 5, lines 31-33). Other virtual machines can also 
be provided at the AP level 302 (column 5, lines 36-37). Thus, Ho does not teach a 
VMM as the operating system because the virtual scanning processor and virtual 
machines execute using a single operating system 300 and does not use a separate 
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operating system for each virtual monitor. Accordingly, Applicants request that the 
instant § 103(a) rejections of claim 27 be withdrawn. 

The dependent claims are novel and nonobvious over the cited references for at 
least the same reasons as discussed above in connection with their respective 
independent claims, in addition to adding further limitations of their own. Accordingly, 
Applicants respectfully request that the instant § 103 rejections of the dependent claims 
also be withdrawn. 

CONCLUSION 

In view of the foregoing remarks, Applicants believe the applicable rejections 
have been overcome and all claims remaining in the application are presently in 
condition for allowance. Accordingly, favorable consideration and a Notice of 
Allowance are earnestly solicited. The Examiner is invited to telephone the undersigned 
representative at (206) 292-8600 if the Examiner believes that an interview might be 
useful for any reason. 
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CHARGE DEPOSIT ACCOUNT 

It is not believed that extensions of time are required beyond those that may 

otherwise be provided for in documents accompanying this paper. However, if 
additional extensions of time are necessary to prevent abandonment of this application, 
then such extensions of time are hereby petitioned under 37 C.F.R. § 1 . 1 36(a). Any fees 
required therefore are hereby authorized to be charged to Deposit Account No. 02-2666. 
Please credit any overpayment to the same deposit account. 



Date:. 




Reg. No. 48,982 
Phone: (206) 292-8600 

1279 Oakmead Parkway 
Sunnyvale, California 
94085-4040 
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